Share This Page

Resolved to be compliant with GDPR

Not surprising that businesses want to comply with the European Union’s General Data Protection Regulation – GDPR.

Think about it.

Penalties and fines up to 4% of a company’s global annual revenue or €20 million or whichever is greater. That’s a lot of revenue to leave to chance.

May 25, 2018 is the enforcement date (absolutely, no rain dates). A lot of pressure here.

Especially, since you’re doing business on the other side of the ocean (“Atlantic” or “pond”), this is a great New Year resolution. Should have been your resolution in 2017. Yes, the EU Parliament adopted GDPR in April 2016, but like most businesses, you didn’t know if the Regulation applied to your business activities in the EU. While that’s an honest excuse, not knowing is unacceptable and will cost you.

But, it’s never too late to do or finish the right thing. If you’ve resolved to respect EU residents’ rights, process and protect their personal information fairly and lawfully, plus maintain compliance with the Regulation, do so.

You need more than a plan. Give your plan a little governance, structure, strategy, implementation, and more. You’ll be well on your way to readiness.

There’re lots of grey areas and moving targets while Britain is exiting the European Union. What is Britain going to do about GDPR? That’s somebody else’s full-time job and worry. Your businesses obligation is to comply. Britain is splitting from the EU but it’s not over GDPR. Even when it’s ready with its own regulation down the line (of course, that would take time), that regulation will likely resemble its cousin, the GDPR. Don’t expect this would mean a grace period for those companies that are not ready by May 25.

Don’t wait. Bad idea.

It’s a business risk to wait until the grey areas become clearer. Better to start and then find out you need to slow down than to be caught unprepared. The UK government and the Information Commissioner’s Office have been very strong and consistent proponents of GDPR. The two have been invaluable resources for awareness and support to the public since the adoption of the Regulation. Don’t expect the UK to scrap GDPR. Keep working on your compliance efforts. Your business has enough concerns and risks to address before May.

Let’s do that first.

Here’s a summary (below) of what you’re resolving to do about GDPR. It may not all apply to you though but that’s a different conversation your business should have with THE PRIVACY ADVOCATEafter you’ve looked through the GDPR Articles below. It is both our passion and full-time job to help your business figure out what these Articles mean and what you’ll need to do to properly address them.

Chapter 3: Rights of the Data Subject
Section 1: Transparency and ModalitiesArticle 12: Transparent information, communication and modalities for the exercise of the rights of the data subject

Section 2: Information and Access to DataArticle 13: Information to be provided where personal data are collected from the data subject
Article 14: Information to be provided where personal data have not been obtained from the data subject
Article 15: Right of access by the data subject

Section 3: Rectification and Erasure
Article 16: Right to rectification
Article 17: Right to erasure (‘right to be forgotten’)
Article 18: Right to restriction of processing
Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing
Article 20: Right to data portability

Section 4: Right to object and automated individual decision making
Article 21: Right to object
Article 22: Automated individual decision-making, including profiling

Section 5: Restrictions
Article 23: Restrictions

Chapter 4: Controller and Processor
Section 1: General Obligations
Article 24: Responsibility of the controller
Article 25: Data protection by design and by default
Article 26: Joint controllers
Article 27: Representatives of controllers not established in the Union
Article 28: Processor
Article 29: Processing under the authority of the controller or processor
Article 30: Records of processing activities
Article 31: Cooperation with the supervisory authority

Chapter 8: Remedies, Liability, and Sanctions
Article 77: Right to lodge a complaint with a supervisory authority
Article 78: Right to an effective judicial remedy against a supervisory authority
Article 79: Right to an effective judicial remedy against a controller or processor
Article 80: Representation of data subjects
Article 81: Suspension of proceedings
Article 82: Right to compensation and liability
Article 83: General conditions for imposing administrative fines
Article 84: Penalties

Chapter 9: Provisions relating to specific data processing situations
Article 85: Processing and freedom of expression and information
Article 86: Processing and public access to offical documents
Article 87: Processing of the national identification number
Article 88: Processing in the context of employment
Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
Article 90: Obligations of secrecy
Article 91: Existing data protection rules of churches and religious associations